HNHacker News
TopNewBestAskShowJobs

code-express

12 karma · joined July 13, 2018

submissionscomments
code-express··on Best to avoid using the “Have I been facebooked” website
> this way the site programmer would reverse back to know your number?

Author here, and yes that is what I claim. This is actually crypto 101 stuff!

1.) Pre computing SHA256 of a small set of numbers (1111111111 - 9999999999) takes only a couple minutes on your average laptop. That is how people find the preimage (password) of leaked password hashes! More sophisticated techniques use rainbow tables etc.

2.) The preimages of Bitcoins, github commits and file hashes have much more entropy to be able to brute force them. Hence, I will not be able to (with todays computing power) find a pre-image of Bitcoin's SHA256 etc. and sadly not become a millionaire overnight :(

3.) Not related to this but hashing functions do get 'weaker' over time as computing power increases. We don't use MD5 anymore for a reason. SHA1 has attacks now (https://shattered.io/). This is why git to move to SHA256 (https://lwn.net/Articles/811068/). n number of years from now, there will be collision attacks on SHA256 as well, at which point we'll have to move to a better, stronger hash!

code-express··on Best to avoid using the “Have I been facebooked” website
There are better ways, that involve more computation on the client side.

For example, HIBP does not send your password (or its complete hash) to the backend in order to find if it has been previously exposed. They use this method: https://blog.cloudflare.com/validating-leaked-passwords-with...

code-express··on Have I Been Facebooked?
The phone numbers put into this website can be trivially reversed despite of the false sense of security the phone-number disclaimer provides: https://code.express/docs/blogs/facebooked/